On Thu, Apr 14, 2022 at 03:01:04PM -0700, Jim Mattson wrote: > On Thu, Apr 14, 2022 at 2:36 PM Peter Xu <peterx@xxxxxxxxxx> wrote: > > > > On Thu, Apr 14, 2022 at 04:14:22PM +0200, Paolo Bonzini wrote: > > > On 4/14/22 15:56, Sean Christopherson wrote: > > > > > - return (pte[index[0]].pfn * vm->page_size) + (gva & 0xfffu); > > > > > + return ((vm_paddr_t)pte[index[0]].pfn * vm->page_size) + (gva & 0xfffu); > > > > This is but one of many paths that can get burned by pfn being 40 bits. The > > > > most backport friendly fix is probably to add a pfn=>gpa helper and use that to > > > > place the myriad "pfn * vm->page_size" instances. > > > > > > > > For a true long term solution, my vote is to do away with the bit field struct > > > > and use #define'd masks and whatnot. > > > > > > Yes, bitfields larger than 32 bits are a mess. > > > > It's very interesting to know this.. > > I don't think the undefined behavior is restricted to extended > bit-fields. Even for regular bit-fields, the C99 spec says, "A > bit-field shall have a type that is a qualified or unqualified version > of _Bool, signed > int, unsigned int, or some other implementation-defined type." One > might assume that even the permissive final clause refers to > fundamental language types, but I suppose "n-bit integer" meets the > strict definition of a "type," > for arbitrary values of n. Fair enough. I just noticed it actually make sense to have such a behavior, because in the case of A*B where A is the bitfield (<32 bits) and when B is an int (=32bits, page_size in the test case or a default constant value which will also be treated as int/uint). Then it's simply extending the smaller field into the same size as the bigger one, as 40bits*32bits goes into a 40bits output which needs some proper masking if calculated with RAX, while a e.g. 20bits*32bits goes into 32bits, in which case no further masking needed. Thanks, -- Peter Xu